feat: public events/polls, friends graph, captcha, SSE hardening, and admin UX

Ship product gaps: register/vote pages, friend add/accept/decline/remove, email verify TTL, captcha on login/forgot, soft-fail user actions, SSE abort/shared client, Commando Centrum error toasts, admin delete for events/polls, and IT/NL i18n fills.

Co-authored-by: Cursor <[email protected]>

src/actions/article-comments.ts

@@ -1,71 +1,116 @@
 "use server";
 
 import { revalidatePath } from "next/cache";
+import { redirect } from "next/navigation";
 import { auth } from "@/lib/auth";
 import { prisma } from "@/lib/prisma";
+import { clientIp, rateLimit } from "@/lib/rate-limit";
 import { isAllowed } from "@/lib/services/moderation";
 
 // website_article_comments.comment is VARCHAR(255); keep the write within bounds.
 const COMMENT_MAX = 255;
 
+type CommentOutcome =
+	| "posted"
+	| "empty"
+	| "invalid"
+	| "moderated"
+	| "ratelimit"
+	| "not_found"
+	| "error";
+
+function commentRedirect(slug: string, outcome: CommentOutcome): never {
+	const path = slug ? `/news/${encodeURIComponent(slug)}` : "/news";
+	if (outcome === "posted") redirect(`${path}?comment=posted`);
+	redirect(`${path}?error=${outcome}`);
+}
+
+function isNextRedirect(e: unknown): boolean {
+	return (
+		!!e &&
+		typeof e === "object" &&
+		"digest" in e &&
+		typeof (e as { digest?: unknown }).digest === "string" &&
+		(e as { digest: string }).digest.startsWith("NEXT_REDIRECT")
+	);
+}
+
 /**
  * Post a comment on a news article as the SIGNED-IN user. The author id is read
  * from the session (re-fetched via auth()), never from the submitted FormData,
  * so a crafted form cannot post as another account. The articleId comes from the
  * form and is validated as a BigInt (website_articles.id is UNSIGNED BIGINT).
+ *
+ * Errors redirect back with a machine-readable ?error= code; success redirects
+ * with ?comment=posted.
  */
 export async function postComment(formData: FormData): Promise<void> {
-	const session = await auth();
-	if (!session?.user?.id) return;
-
-	const userId = Number(session.user.id);
-	if (!Number.isFinite(userId)) return;
-
-	const comment = String(formData.get("comment") ?? "")
-		.normalize("NFC")
-		.trim()
-		.slice(0, COMMENT_MAX);
-	if (!comment) return;
-
-	// Block filtered/AI-flagged content before it touches the DB (fail-open).
-	if (!(await isAllowed(comment)).ok) return;
-
-	const articleIdRaw = String(formData.get("articleId") ?? "")
+	const slugHint = String(formData.get("slug") ?? "")
 		.normalize("NFC")
 		.trim();
-	if (!/^\d+$/.test(articleIdRaw)) return;
 
-	let articleId: bigint;
+	let outcome: CommentOutcome = "error";
+	let slug = slugHint;
+
 	try {
-		articleId = BigInt(articleIdRaw);
-	} catch {
-		return;
-	}
+		const session = await auth();
+		if (!session?.user?.id) {
+			redirect("/login");
+		}
 
-	let slug: string | null;
-	try {
-		// Confirm the article exists (and grab its slug for revalidation).
-		const article = await prisma.websiteArticles.findUnique({
-			where: { id: articleId },
-			select: { slug: true },
-		});
-		if (!article) return;
-		slug = article.slug;
+		const userId = Number(session.user.id);
+		if (!Number.isFinite(userId) || userId <= 0) {
+			redirect("/login");
+		}
 
-		const now = new Date();
-		await prisma.websiteArticleComments.create({
-			data: {
-				articleId,
-				userId,
-				comment,
-				createdAt: now,
-				updatedAt: now,
-			},
-		});
-	} catch {
-		// DB unavailable — fail soft; nothing to persist.
-		return;
+		await clientIp();
+		if (!(await rateLimit(`comment:${userId}`, 5, 30_000)).ok) {
+			outcome = "ratelimit";
+		} else {
+			const comment = String(formData.get("comment") ?? "")
+				.normalize("NFC")
+				.trim()
+				.slice(0, COMMENT_MAX);
+			if (!comment) {
+				outcome = "empty";
+			} else if (!(await isAllowed(comment)).ok) {
+				outcome = "moderated";
+			} else {
+				const articleIdRaw = String(formData.get("articleId") ?? "")
+					.normalize("NFC")
+					.trim();
+				if (!/^\d+$/.test(articleIdRaw)) {
+					outcome = "invalid";
+				} else {
+					const articleId = BigInt(articleIdRaw);
+					const article = await prisma.websiteArticles.findUnique({
+						where: { id: articleId },
+						select: { slug: true },
+					});
+					if (!article) {
+						outcome = "not_found";
+					} else {
+						slug = article.slug;
+						const now = new Date();
+						await prisma.websiteArticleComments.create({
+							data: {
+								articleId,
+								userId,
+								comment,
+								createdAt: now,
+								updatedAt: now,
+							},
+						});
+						outcome = "posted";
+					}
+				}
+			}
+		}
+	} catch (e) {
+		if (isNextRedirect(e)) throw e;
+		outcome = "error";
 	}
 
 	if (slug) revalidatePath(`/news/${slug}`);
+	commentRedirect(slug, outcome);
 }